We are terminating SSL right on the server (node) which is listening on TCP 9443. Our VS is listening on 443, HTTP profile is set to none and port translation is enable. In this scenario we are not able to display the page. When we change VS to listen on 9443 we have no issues. Any idea why?

Just set the 9443 port in node configuration and keep your VS on 443.

Hi, use a capture tool to check if there is a http redirect to the 9443 port.

No, it doesn't works. When I set VS to listen on all ports I'm getting a security warning (old cert on the server) but I have to click twice on 'continue' to see the page.

I answered on Renato segustion. Soon server admin will insatall a valid certificate and than I will try again.

TCP port translation problem

13 Replies

Renato
Altostratus
Nov 05, 2015
Just set the 9443 port in node configuration and keep your VS on 443.
Stanislas_Piro2
Cumulonimbus
Nov 05, 2015
Hi,

use a capture tool to check if there is a http redirect to the 9443 port.
Krys_Frankiewic
Nimbostratus
Nov 05, 2015
No, it doesn't works. When I set VS to listen on all ports I'm getting a security warning (old cert on the server) but I have to click twice on 'continue' to see the page.
- Stanislas_Piro2
  Cumulonimbus
  Nov 05, 2015
  Who are you answering to?
Krys_Frankiewic
Nimbostratus
Nov 05, 2015
I answered on Renato segustion. Soon server admin will insatall a valid certificate and than I will try again.
Stanislas_Piro2
Cumulonimbus
Nov 05, 2015
if you configure SSL terminaison on F5, there is no need to install a valid certificate on server.

you must create:

pool with members on port 9443
VS on port 443
client SSL profile with valid certificate
server SSL profile
Pool previously defined
SNAT if needed

after that, try to connect with firefox and firebug enabled and check if server reply with port 9443 in redirect of html links.
Krys_Frankiewic
Nimbostratus
Nov 05, 2015
I know that this scenario will works, we have many SSL termination on F5. Request from the client is not to install on F5, only on the servers. That kaind scenario also works as long we don't do any port translation. Unfortunately server can't listen on 443, only on 9443.
- Stanislas_Piro2
  Cumulonimbus
  Nov 05, 2015
  so this is the same configuration but without clientssl and serverssl profiles. the server replies must not include service port.
- Renato_166638
  Nimbostratus
  Nov 05, 2015
  The VS in your case should work the same way like any other HTTP or SSL terminated. You just have to set the correct ports on nodes and VS configuration and configure it to use L4/TCP profile. Don't use all ports and set the same SNAT option that is working with the other VSs you already have.
Krys_Frankiewic
Nimbostratus
Nov 05, 2015
TCP port translation is not working, I don't see session to server on any port. Under pool I'm allowing SNAT. Nodes are set to TCP 9443 VS setting: Type: standard Service port: 443 protocal profile: tcp other protocols are set to none Address and port translation: enable

I tried type performance layer 4, did not work
- Renato_166638
  Nimbostratus
  Nov 05, 2015
  SNAT enabled? Did you try automap? This configuration simply works, maybe you are facing a network design problem. Is this new node in the same VLAN and IP subnet as the other nodes?
Krys_Frankiewic
Nimbostratus
Nov 06, 2015
I don't have design problem, just protocol translation in this specific setting is not working. SNAT is enabled, I have many VS configured with out any problems. If VS and nodes are listen on the sam TCP port everything works. If I VS is listen on a different port than nodes, transaction is failing.
- Renato_166638
  Nimbostratus
  Nov 06, 2015
  Well... in this case the configuration suggested by Stanislas have to work for you. Going further on Stanislas's suggestions, you will have to use tcpdump to understand what is going on with your configuration.